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1. An apparatus (22,44) for use in generating configuration information for a computer 
system (12) employing hierarchical entities, the apparatus comprising: 

means (42) for receiving a definition (24) of a high-level policy, for the configuration of 
the system, and permitted refinements to that policy, the definition referring to a plurality of the 
5 entities; 

means (16) for storing information about the computer system and its environment 
including the entities, the hierarchy thereof and non-hierarchical relations between the entities; 
and 

a processor (26) coupled to the receiving means and the storing means and operable to 
10 refine the high-level policy definition with reference to the permitted refinements thereto and the 
stored information about the entities to which the high-level policy definition relates in order to 
produce a refined policy definition deployable on the computer system. 

2. An apparatus as claimed in claim 1, and including a user interface (28) with which a 
user (10) can interact with the apparatus. 

15 3. An apparatus as claimed in claim 2, wherein the processor is operable, in accordance 
with the high-level policy definition, to present refinement options to the user via the user 
interface and to refine the high-level policy definition in dependence upon options selected by 
the user via the user interface. 

4. An apparatus (22,44) for use in generating configuration information for a computer 
20 system (12) employing hierarchical entities, the apparatus comprising: 

means (42) for receiving a definition (24) of a high-level policy, for the configuration of 
the system, and permitted refinements to that policy, the definition referring to a plurality of the 
entities; 

a user interface (28) with which a user (10) can interact with the apparatus; 
25 a processor (26) coupled to the receiving means and the user interface and operable, in 

accordance with the high-level policy definition, to present refinement information to the user 
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via the user interface so that a refined policy definition deployable on the computer system can 
be produced. 

5. An apparatus as claimed in claim 4, wherein the processor is operable to present the 
refinement information to the user as refinement options and to refine the high-level policy 
definition in dependence upon options selected by the user via the user interface to produce the 
refined policy definition. 

6. An apparatus as claimed in any of claims 2 to 5, and including a library (14) of policy 
templates (24), each template including a respective such high-level policy definition and 
respective such permitted policy refinements, the library being coupled to the receiving means, 
and a desired one or more of the policy templates being selectable by the user via the user 
interface for supply to the receiving means. 

7. An apparatus as claimed in claim 6, wherein the policy templates have a common 
format. 

8. An apparatus as claimed in claim 6 or 7 when dependent on claim 3 or 5, wherein the 
policy template format provides for each policy template to have a plurality of components 
executable in turn by the processor, at least one of the components being a flow directive and 
causing the processor to present such options to the user via the user interface and to jump to 
one of a plurality of the other components in dependence upon the flow directive and the 
selection made by the user via the user interface. 

9. An apparatus as claimed in any of claims 1 to 3, or any of claims 6 to 8 when dependent 
thereon, wherein at least some of the entities stored in the storing means are abstract entities, 
the storing means also including, for each such abstract entity, a pointer to data in the computer 
system representing an instance of that abstract entity. 



10. 



An apparatus as claimed in claim 9, wherein: 
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the refined policy is in terms of a policy context referring to unbound entities and a 
policy statement; 

the apparatus includes means (20) for storing rules for interpreting the policy statement 
as instructions executable by the computer system; and 

the processor (20) is operable, with reference to the entity storing means, to bind the 
unbound entities in the policy context to instances of those entities, and, with reference to the 
rule storing means, to interpret the policy statement into a series of instructions to the computer 
system referring to the bound instances or derivatives of them. 

11. An apparatus (22,44) for use in generating configuration information for a computer 
system (12), the apparatus comprising: 

means (20) for receiving a policy (18), for the configuration of the computer system, in 
terms of a policy context referring to unbound entities and a policy statement; 

means (16) for storing, for each of the unbound entities, a pointer to data in the 
computer system representing at least one instance of that entity; 

means (20) for storing rules for interpreting the policy statement as instructions 
executable by the computer system; and 

a processor (20) which is operable, with reference to the pointers, to bind the unbound 
entities in the policy context to instances of those entities, and, with reference to the 
interpretation rules, to interpret the policy statement into a series of instructions to the computer 
system referring to the bound instances or derivatives of them. 

12. An apparatus as claimed in claim 10 or 11, wherein the processor is operable to 
determine a group of the bound instances, and at least one of the instructions refers to such a 
determined group. 

13. An apparatus as claimed in claim 12, wherein the processor is operable to determine, 
with reference to the entity storing means, whether such a determined group is already defined 
in the computer system and, if not, to generate such an instruction to create the determined 
group in the computer system. 
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14. A method for use in generating configuration information for a computer system 
employing hierarchical entities, the method comprising the steps of: 

receiving a definition of a high-level policy, for the configuration of the system, and 
permitted refinements to that policy, the definition referring to a plurality of the entities; and 
5 refining the high-level policy definition with reference to the permitted refinements 

thereto and stored information about the entities to which the high-level policy definition relates 
in order to produce a refined policy definition deployable on the computer system. 

15. A method as claimed in claim 14, and including the steps of: 

presenting refinement options, in accordance with the high-level policy definition, to the 
10 user via a user interface; and 

refining the high-level policy definition in dependence upon options selected by the user 
via the user interface. 

16. A method for use in generating configuration information for a computer system 
employing hierarchical entities, the method comprising the steps of: 

15 receiving a definition of a high-level policy, for the configuration of the system, and 

permitted refinements to that policy, the definition referring to a plurality of the entities; 

presenting refinement information, in accordance with the high-level policy definition, 
to a user via a user interface so that a refined policy definition deployable on the computer 
system can be produced. 

20 17. A method as claimed in claim 16, wherein the refinement information is presented to 
the user as refinement options, and further including the step of refining the high-level policy 
definition in dependence upon options selected by the user via the user interface to produce the 
refined policy definition. 

18. A method as claimed in any of claims 14 to 17, and including the steps of: 
25 providing a library of policy templates, each template including a respective such high- 

level policy definition and respective such permitted policy refinements; and 

selecting one or more of the policy templates for refinement in accordance with input by 
the user via a user interface. 
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19. A method as claimed in claim 18, wherein the policy templates have a common format. 

20. A method as claimed in claim 18 or 19 when dependent on claim 15 or 17, wherein the 
policy template format provides for each policy template to have a plurality of components 
executable in turn during refinement, at least one of the components being a flow directive and 

5 causing such options to be presented to the user via the user interface and the refinement 
process to jump to one of a plurality of the other components in dependence upon the flow 
directive and the selection made by the user via the user interface. 

21. A method as claimed in claim 14 or 15, or any of claims 18 to 20 when dependent 
thereon, wherein: 

10 the refined policy is in terms of a policy context referring to unbound entities and a 

policy statement; 

the stored information about at least some of the entities relates to abstract entities, and 
includes, for each such abstract entity, a pointer to data in the computer system representing an 
instance of that abstract entity; and 
15 the method further includes the steps of: binding, with reference to the stored 

information, the unbound entities in the policy context to instances of those entities; and 
interpreting, with reference for stored rules for interpreting the policy statement as instructions 
executable by the computer system, the policy statement into a series of instructions to the 
computer system referring to the bound instances or derivatives of them. 

20 22. A method for use in generating configuration information for a computer system, the 
method comprising the steps of: 

receiving a policy, for the configuration of the computer system, in terms of a policy 
context referring to unbound entities and a policy statement; 

storing, for each of the unbound entities, a pointer to data in the computer system 
25 representing at least one instance of that entity; 

storing rules for interpreting the policy statement as instructions executable by the 
computer system; and 

binding, with reference to the pointers, the unbound entities in the policy context to 
instances of those entities; and 
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interpreting, with reference to the interpretation rules, the policy statement into a series 
of instructions to the computer system referring to the bound instances or derivatives of them. 

23. A method as claimed in claim 21 or 22, further including the steps of determining a 
group of the bound instances, and referring to such a determined group in at least one of the 
instructions. 

24. An method as claimed in claim 23, further including the steps of: determining, with 
reference to stored information about the entities, whether such a determined group is already 
defined in the computer system; and, if not, generate such an instruction to create the 
determined group in the computer system. 



